Vulnerability · Published Jul 7, 2025 · Assigned by @huntr_ai

CVE-2025-6386Timing Attack Vulnerability in parisneo/lollms

High 7.5

In plain English

A high-severity security flaw in parisneo/lollms from parisneo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.4%top 64.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

The parisneo/lollms repository is affected by a timing attack vulnerability in the `authenticate_user` function within the `lollms_authentication.py` file. This vulnerability allows attackers to enumerate valid usernames and guess passwords incrementally by analyzing response time differences. The affected version is the latest, and the issue is resolved in version 20.1. The vulnerability arises from the use of Python's default string equality operator for password comparison, which compares characters sequentially and exits on the first mismatch, leading to variable response times based on the number of matching initial characters.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	lollms	no fix listed	GHSA-j5pr-vrjj-9v4h
PyPI	lollms	no fix listed	PYSEC-2026-1590

Affected products (as reported)

Vendor	Product	Versions
parisneo	parisneo/lollms	unspecified – before 20.1

Weakness: CWE-203 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References